defaultConfig:
  proxyMetadata:
    CANONICAL_REVISION: latest
    CANONICAL_SERVICE: foo
    ISTIO_META_CLUSTER_ID: Kubernetes
    ISTIO_META_DNS_CAPTURE: "true"
    ISTIO_META_MESH_ID: ""
    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
    POD_NAMESPACE: bar
    SERVICE_ACCOUNT: vm-serviceaccount
    TRUST_DOMAIN: ""

# If you want to make a change in this file, edit the original one and run "make gen".

# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:
    PILOT_ENABLE_AMBIENT: "true"
cni:
  ambient:
    enabled: true

# If you want to make a change in this file, edit the original one and run "make gen".

# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:
    PILOT_ENABLE_AMBIENT: "true"
cni:
  ambient:
    enabled: true

# If you want to make a change in this file, edit the original one and run "make gen".

# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:
    PILOT_ENABLE_AMBIENT: "true"
cni:
  ambient:
    enabled: true

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio
spec:
  profile: default
  meshConfig:
    defaultConfig:
      proxyMetadata:
        ISTIO_DUAL_STACK: false
        PROXY_XDS_VIA_AGENT: false
  values:
    pilot:
      env:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio
spec:
  profile: default
  meshConfig:
    defaultConfig:
      proxyMetadata:
        PROXY_UPSTREAM_WEIGHT: "0.85"
        PROXY_DOWNSTREAM_WEIGHT: "0.15"
  values:
    pilot:
      env:

defaultConfig:
  proxyMetadata:
    # should be overridden by the command
    ISTIO_META_DNS_CAPTURE: "false"
    # should be overridden by the annotation on the WorkloadGroup
    PROXY_CONFIG_ANNOT_VALUE: "foo"
    # should be in the final cluster.env/mesh.yaml

kind: WorkloadGroup
metadata:
  name: foo
  namespace: bar
spec:
  metadata:
    annotations:
      proxy.istio.io/config: |-
        proxyMetadata:
          # this should override the value from the global meshconfig
          PROXY_CONFIG_ANNOT_VALUE: bar
    labels: {}
  template:
    ports: {}
    serviceAccount: vm-serviceaccount
  probe:
    httpGet:

			a.Security.RootCertFilePath = cfg.CaCertificatePath
			a.ProxyConfig.ProxyMetadata = map[string]string{}
			a.ProxyConfig.ProxyMetadata[MetadataClientCertChain] = filepath.Join(dir, "cert-chain.pem")
			a.ProxyConfig.ProxyMetadata[MetadataClientCertKey] = filepath.Join(dir, "key.pem")
			a.ProxyConfig.ProxyMetadata[MetadataClientRootCert] = filepath.Join(dir, "root-cert.pem")
			a.Security.FileMountedCerts = true

apiVersion: release-notes/v2
kind: feature
area: installation
releaseNotes:
- |